[SOLVED] Google - can not open any link - malware ??

Joseph_sys · Last edited by Joseph_sys on Thu Feb 09, 2012 2:45 pm; edited 2 times in total

I have a strange problem.
I can not open any link in Google. Bing work OK.

Any idea what to look for?
I'm using firefox.

Jaglover · Posted: Wed Feb 08, 2012 12:45 pm Post subject:

Did you install some anti-google plugin perhaps?

_________________
My Gentoo installation notes.
Please learn how to denote units correctly!

Joseph_sys · Posted: Wed Feb 08, 2012 4:27 pm Post subject:

Joseph_sys · Posted: Wed Feb 08, 2012 11:25 pm Post subject:

When I disable Java in Firefox I can open any link in Google, with Java enabled I can not open any link

I got an email from one local Linux user regarding hosts file.
Apparently there's a malware running around that redirects all google services via the hosts file which superceded DNS.
All other sites work fine, but any google sites get directed
elsewhere.

But I don't have any more information on this.

Jaglover · Posted: Wed Feb 08, 2012 11:52 pm Post subject:

In *nix systems user cannot write into hosts file, it has to be something else.
_________________
My Gentoo installation notes.
Please learn how to denote units correctly!

Joseph_sys · Posted: Thu Feb 09, 2012 12:00 am Post subject:

Jaglover · Posted: Thu Feb 09, 2012 12:20 am Post subject:

Usually problems like this are down to user settings. Have you tried creating a test user, does this problem still exist?

Anyhow, if you suspect your hosts file is compromised why don't you check it?
_________________
My Gentoo installation notes.
Please learn how to denote units correctly!

Joseph_sys · Posted: Thu Feb 09, 2012 2:16 am Post subject:

Jaglover · Posted: Thu Feb 09, 2012 2:32 am Post subject:

You do realize test profile and test user are not the same thing? A test user has clean home directory, whatever is screwed up for your user won't be there.
_________________
My Gentoo installation notes.
Please learn how to denote units correctly!

Joseph_sys · Posted: Thu Feb 09, 2012 3:36 am Post subject:

Joseph_sys · Posted: Thu Feb 09, 2012 5:59 am Post subject:

If I disable Java under: Preference --> Content: JavaScript
I can open Google links but I need "JavaScript" to be enabled as some of my internal program depend on it.

What is causing it? I downgraded to Firefox-8 same thing. I can not open any Google links if "JavaScript" is enabled.

Gusar · Posted: Thu Feb 09, 2012 1:20 pm Post subject:

Just for the record: Java and JavaScript are two *completely* different things.

Anyway, I just got hit by the same issue. Google is getting crappier and crappier by the day, I tell you. What happened to the lean, mean, simple search engine that everyone fell in love with? Now they're just bloating it with unnecessary javascript crap.

Hmm, one idea: Do you accept cookies from google? I don't. If you don't either, try activating them and see if it works then.

swanson · Posted: Thu Feb 09, 2012 2:42 pm Post subject:

Definitely a cookie requirement.

I use and have www.google.co.uk blocked from setting cookies. Unblocking allows the links to load. Must be some recent change, either deliberately to enforce tracking with their privacy changes but might possibly be a programming error by Google.

Ghostery, AdBlockPlus and third party cookie blocking were not relevant. However still have all cookies deleted when session closes except those allowed. Will monitor to see what happens....
_________________
Alan.

Joseph_sys · Posted: Thu Feb 09, 2012 2:44 pm Post subject:

I noticed that too, if I set to accept the cookies it works.
I don't intent to accept Google cookies. It seems to me Google is getting more evil than Mircrosoft.

I'll be switching to Bing.

Gusar · Posted: Thu Feb 09, 2012 3:09 pm Post subject:

Tolstoi · l33t Joined: 20 May 2004 Posts: 678

Got the same problem here.

Unfortunately your solution doesn't work for me Gusar.

swanson · Posted: Thu Feb 09, 2012 11:01 pm Post subject:

And Google have pushed a fix according to Mozilla bug 725634. Works for me with blocked cookies again.
_________________
Alan.

Gusar · Posted: Thu Feb 09, 2012 11:22 pm Post subject:

miroR · l33t Joined: 05 Mar 2008 Posts: 826

miroR · l33t Joined: 05 Mar 2008 Posts: 826

And here's why I can't take the Schmoog, the Schmoogle-Boogle-Woogle. They're the pro hitsquad, along with the informants and generally the nuissance of the Internet.

Why you're letting your poor stingy lying hearts drown in money, all you the Schmoog? The heart of a human is for dignity, for truth, for respect, for love, and what do you do, poor obnoxious little monsters with washed faces claiming they just "do no evil"?

I'm already having two big issues on my hands, and I was trying to fully report the second one...

(the first one, a really big problem to solve, being postponed:

Recover partly overwritten luks volume?
https://forums.gentoo.org/viewtopic-t-1004014.html

and the second one is outside these parens)

[I was trying to fully report] the second one of my issues that break my back with intensity of a poor user's (me) research:

Syslog-ng from Delay in Logging to Broken Pipe and no Logging
https://forums.gentoo.org/viewtopic-t-1001994.html#7667580

where you can read, currently (and if I make it to arrange well, I will keep that beginning to that post there):

Can't do.

Having errors with the Forums.

This is what I just sent to a moderator:

I'm trying to post:
http://croatiafidelis.hr/gnu/gentoo/Gen_141214_syslog-ng_sync_HID_2rr.txt

It is less then 80k.
================
It shows fine in preview.
================
Is cut short when submitted.

What do I do?
I've never yet had it that the preview is fine, but does not show like previewed when submitted.
Thanks,
Miro
---

But I do dumpcap captures, I conntrack log and I also screencast [1] what I do online, and I analyze those for times often multiple, and two and three digit multiple if needed, of the time that I spend online, and so, while the:

miroR · l33t Joined: 05 Mar 2008 Posts: 826

I have decided to move my reply to Princess Nell here where I believe it belongs, more appropriately.

It was originally in this topic:

Updating and keeping your Gentoo non-poeterized
https://forums.gentoo.org/viewtopic-t-1012022-start-25.html#7713604

You can see that I have linked to here from there, so nothing of the conversation is lost. No time to beg and wait for Moderators and Administrators to do it better, while this was quick and should work...

And there is a backdoorish program there that I identified, This topic is noise for that one, as that one would be noise here.
---

steveL · Posted: Mon Mar 09, 2015 12:57 pm Post subject:

miroR · l33t Joined: 05 Mar 2008 Posts: 826

Princess Nell wrote in the other topic, these fine two posts that I am hereby replying to by first quoting them completely.
----

Princess Nell · l33t Joined: 15 Apr 2005 Posts: 916

You could do worse than heeding steveL's suggestions.

miroR · l33t Joined: 05 Mar 2008 Posts: 826

I'll try and see what my Firefox, that never saw any online, because it is from my master Gentoo machine that never ever sees any online, as I never connect it to the internet, has on me.

[I'll try and see what my Firefox has on me], before I even fire it up in this cloned Gentoo machine, cloned from that master Gentoo machine (dd dump save the master box's system patitions, and dd dump restore them onto this cloned box, and some configuration to do, same MBO and same or very similar hardware in both).

Why? Because of the insistence on the possible goodness or fixability of it, by Princess Nell here, and also elsewhere by others, in the face of my demonstrations.

In the face of my demonstrations, with links deployed in full view, which links lead you to full presentations, minimal effort --but not negligeable, unless advanced-- needed on your part to understand those, yes, but those complete presententions of concrete short intervals of real time of mine online are fruit of incomparably more effort invested from my part as far as those choice moments go.

All that particular time invested to present those is on top of the broader effort, because those are the choice kind of moments that are not necessarily repeatable, a one-time events, and likely not reproducible: the bot that did the sending of mail from my machine on me in the clickjacking presentation.

You can try and tell me if it would do the same on your machine, or was it programmed to work only on some chosen connections, like mine, a dissenter's connection?

(Schmoog and Yooch are at whichever the local regime's service, and in cahoots for privacy breaking, and they trade with them the info and do dirty deals, and also local personnel work in the local tasks and whatever is of any regional work/area-of-interest/other.)

And another reason why I decided to [try and see what my Firefox] has on me, is also because of this:

https://forums.gentoo.org/viewtopic-t-1012022.html#7713332
where I only asked somebody to kindly report if this page:
Uninstalling dbus and *kits (to Unfacilitate Remote Seats is excessively broad, and and so not displayed in full breadth in Firefox on a 1024x768 display.

Got no reply, so that'll be the sole page that I will open. The check is only an excuse. I want to show firefox's data harvesting, just the beginning of it, how it works.

And for that purpose I'm preparing this text upfront.

Why? Because I want to post the identificating SHA256 sums of both the packet capture Pcap-ng file and of the screencast, of that short interval of time. So I can take my time to explain what happened, and noone can really doubt, once --whenever at any later time-- they get those exact files downloaded for themselves, that I was inventing things, or that I messed up with those files.

So, the Firefox is vanilla, vergin, untouched by any connections from the outer, the internet, world, yet.

I'll try and remember to rename/hide via, sed'ing, the salt (the f8rsbgui.default) and my username, and such, as usual, before posting this publically.

I cd into: